Vulnerability
Published 2026-09-10
Verified 2026-09-19
Apache Tika ISA-Tab path traversal file read (CVE-2026-66755); Ubuntu USN-8717-1
Ubuntu Security Notice USN-8717-1 (noticed on HN 10 September 2026): Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who can place files in a directory that Tika subsequently parses can read arbitrary files accessible to the Tika process, with contents emitted into extracted text. Fixes via Ubuntu Pro ESM Apps: jammy libtika-java 1.22-2+deb11u1ubuntu0.1~esm2; focal libtika-java 1.22-1ubuntu0.1~esm3. Primary: Ubuntu USN-8717-1.
- Product
- Apache Tika (libtika-java)
- Versions
- Ubuntu 22.04/20.04 ESM packages listed in USN-8717-1
- Exploited in Australia?
- unknown
- Patch to
- Update libtika-java per USN-8717-1 (Ubuntu Pro ESM Apps)
Primary: Ubuntu USN-8717-1 — Apache Tika CVE-2026-66755 · Vendor: Ubuntu Security · CVE: CVE-2026-66755